{"id":6219,"date":"2024-04-27T09:02:20","date_gmt":"2024-04-27T00:02:20","guid":{"rendered":"https:\/\/m365jp.net\/?p=6219"},"modified":"2024-04-27T09:15:52","modified_gmt":"2024-04-27T00:15:52","slug":"mc787370-advanced-hunting-permissions-update-for-some-microsoft-defender-for-office-365-security-admins","status":"publish","type":"post","link":"https:\/\/m365jp.net\/index.php\/2024-04-27-mc787370-advanced-hunting-permissions-update-for-some-microsoft-defender-for-office-365-security-admins","title":{"rendered":"MC787370 | Advanced Hunting Permissions update for some Microsoft Defender for Office 365 security admins"},"content":{"rendered":"<div class=\"postie-post\">\n<div>\n<hr>\n<table id=\"section\">\n<tbody>\n<tr>\n<th width=\"95%\">MC787370 | Advanced Hunting Permissions update for some Microsoft Defender for Office 365 security admins<\/th>\n<\/tr>\n<\/tbody>\n<\/table>\n<hr>\n<table id=\"data\">\n<tbody>\n<tr>\n<th>Classification<\/th>\n<td>planForChange<\/td>\n<\/tr>\n<tr>\n<th>Last Updated<\/th>\n<td>04\/26\/2024 23:12:05<\/td>\n<\/tr>\n<tr>\n<th>Start Time<\/th>\n<td>04\/26\/2024 23:11:44<\/td>\n<\/tr>\n<tr>\n<th>End Time<\/th>\n<td>06\/30\/2024 07:00:00<\/td>\n<\/tr>\n<tr>\n<th>Message Content<\/th>\n<td>\n<p>We&#8217;ve changed the permissions mechanism to access Email &amp; collaboration schema in Advanced Hunting for Microsoft Defender for Office 365 customers, to align with Threat Explorer.<\/p>\n<p>[When this will happen:]<\/p>\n<p>We will begin rolling out in early May 2024 and expect to complete by late May 2024.<\/p>\n<p>[How this will affect your organization:]<\/p>\n<p>Impacted users:<\/p>\n<p>Security teams that are using Defender XDR Email &amp; collaboration schema in Advanced Hunting (<a href=\"https:\/\/security.microsoft.com\/v2\/advanced-hunting\">security.microsoft.com\/v2\/advanced-hunting<\/a>)  <\/p>\n<ul>\n<li>Users assigned to Exchange Online Protection role groups View-only Manage alerts, Manage alerts, View-only audit logs, Audit logs, and Organization configuration. These role groups are configured in the Defender portal, under Permissions \/ Email &amp; collaboration   Roles \/ Roles, or in the Purview compliance portal under Roles and Scopes\/Permissions.  <\/li>\n<li>Users assigned the following permissions using Defender XDR Unified RBAC for Microsoft Defender for Office 365:\n<ul>\n<li>Security operations \/ Security data basics (read), without Security operations \/ Raw data \/ Email &amp; collaboration metadata (read)).<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p>Previously, these roles granted access to Microsoft Defender for Office 365 Alerts and Incidents, as well as Email &amp; collaboration schema in Advanced Hunting.<\/p>\n<p>  <\/p>\n<p>[What you need to do to prepare:]  <\/p>\n<p>After rolling out this change, these roles will continue to grant access to Microsoft Defender for Office 365 Alerts and Incidents, but not Email &amp; collaboration schema in Advanced Hunting.&nbsp;<\/p>\n<p>If you are willing to continue and grant your teams access to Email &amp; collaboration schema in Advanced Hunting, please assign them one of the following permissions, same as required to access Threat Explorer:<\/p>\n<ul>\n<li>If Defender XDR Unified RBAC is active for Email &amp; collaboration: please assign:<br \/>  Security operations \/ Raw data \/ Email &amp; collaboration metadata (read) permission.<\/li>\n<li>If Defender XDR Unified RBAC is not active for Email &amp; collaboration, please assign the following Email &amp; collaboration permissions in the Defender portal:  <br \/>  Security Reader, Security Operator, Security Administrator, Exchange Administrator, Global Reader, View-Only Recipients, Organization Management.<\/li>\n<\/ul>\n<p>Notes:  <\/p>\n<ul>\n<li>This change does not impact access to Threat Explorer<\/li>\n<li>Global Entra ID roles are not impacted by this change<\/li>\n<\/ul>\n<p>Please review the following resources to learn more:<\/p>\n<ul>\n<li>For additional information on Advanced Hunting permissions, see <a href=\"https:\/\/learn.microsoft.com\/microsoft-365\/security\/defender\/custom-roles?view=o365-worldwide\" target=\"_blank\" rel=\"noopener\">  Custom roles for role-based access control | Microsoft Learn<\/a><\/li>\n<li>For additional information on Threat Explorer permissions, see <a href=\"https:\/\/learn.microsoft.com\/microsoft-365\/security\/office-365-security\/threat-explorer-real-time-detections-about?view=o365-worldwide#permissions-and-licensing-for-threat-explorer-and-real-time-detections\" target=\"_blank\" rel=\"noopener\">  About Threat Explorer and Real-time detections in Microsoft Defender for Office 365 | Microsoft Learn<\/a>  <\/li>\n<\/ul>\n<\/td>\n<\/tr>\n<tr>\n<th>Machine Translation<\/th>\n<td>\n<p>\u8105\u5a01\u30a8\u30af\u30b9\u30d7\u30ed\u30fc\u30e9\u30fc\u306b\u5408\u308f\u305b\u3066\u3001Microsoft Defender for Office 365 \u306e\u304a\u5ba2\u69d8\u5411\u3051\u306e\u9ad8\u5ea6\u306a\u30cf\u30f3\u30c6\u30a3\u30f3\u30b0\u3067\u96fb\u5b50\u30e1\u30fc\u30eb &amp; \u30b3\u30e9\u30dc\u30ec\u30fc\u30b7\u30e7\u30f3 \u30b9\u30ad\u30fc\u30de\u306b\u30a2\u30af\u30bb\u30b9\u3059\u308b\u305f\u3081\u306e\u30a2\u30af\u30bb\u30b9\u8a31\u53ef\u30e1\u30ab\u30cb\u30ba\u30e0\u3092\u5909\u66f4\u3057\u307e\u3057\u305f\u3002<\/p>\n<p>[\u3053\u308c\u304c\u3044\u3064\u8d77\u3053\u308b\u304b:]<\/p>\n<p>2024 \u5e74 5 \u6708\u4e0a\u65ec\u306b\u30ed\u30fc\u30eb\u30a2\u30a6\u30c8\u3092\u958b\u59cb\u3057\u30012024 \u5e74 5 \u6708\u4e0b\u65ec\u307e\u3067\u306b\u5b8c\u4e86\u3059\u308b\u4e88\u5b9a\u3067\u3059\u3002<\/p>\n<p>[\u3053\u308c\u304c\u7d44\u7e54\u306b\u53ca\u307c\u3059\u5f71\u97ff:]<\/p>\n<p>\u5f71\u97ff\u3092\u53d7\u3051\u308b\u30e6\u30fc\u30b6\u30fc:<\/p>\n<p>\u9ad8\u5ea6\u306a\u30cf\u30f3\u30c6\u30a3\u30f3\u30b0 (<a href=\"https:\/\/security.microsoft.com\/v2\/advanced-hunting\">security.microsoft.com\/v2\/advanced-hunting<\/a>) \u3067 Defender XDR \u96fb\u5b50\u30e1\u30fc\u30eb &amp; \u30b3\u30e9\u30dc\u30ec\u30fc\u30b7\u30e7\u30f3 \u30b9\u30ad\u30fc\u30de\u3092\u4f7f\u7528\u3057\u3066\u3044\u308b\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3 \u30c1\u30fc\u30e0<\/p>\n<ul>\n<li>Exchange Online Protection \u5f79\u5272\u30b0\u30eb\u30fc\u30d7\u306e [\u8868\u793a\u306e\u307f\u306e\u7ba1\u7406] \u3001 [\u30a2\u30e9\u30fc\u30c8\u306e\u7ba1\u7406] \u3001 [\u8868\u793a\u306e\u307f\u306e\u76e3\u67fb\u30ed\u30b0] \u3001 [\u76e3\u67fb\u30ed\u30b0] \u3001 [\u7d44\u7e54\u306e\u69cb\u6210] \u306b\u5272\u308a\u5f53\u3066\u3089\u308c\u3066\u3044\u308b\u30e6\u30fc\u30b6\u30fc\u3002 \u3053\u308c\u3089\u306e\u5f79\u5272\u30b0\u30eb\u30fc\u30d7\u306f\u3001Defender \u30dd\u30fc\u30bf\u30eb\u306e [\u30a2\u30af\u30bb\u30b9\u8a31\u53ef] \/ [\u96fb\u5b50\u30e1\u30fc\u30eb &amp; \u30b3\u30e9\u30dc\u30ec\u30fc\u30b7\u30e7\u30f3 \u30ed\u30fc\u30eb] \/ [\u30ed\u30fc\u30eb] \u306e\u4e0b\u3001\u307e\u305f\u306f Purview \u30b3\u30f3\u30d7\u30e9\u30a4\u30a2\u30f3\u30b9 \u30dd\u30fc\u30bf\u30eb\u306e [\u30ed\u30fc\u30eb\u3068\u30b9\u30b3\u30fc\u30d7\/\u30a2\u30af\u30bb\u30b9\u8a31\u53ef] \u3067\u69cb\u6210\u3055\u308c\u307e\u3059\u3002<\/li>\n<li>Microsoft Defender for Office 365\u306eDefender XDR \u7d71\u5408 RBAC \u3092\u4f7f\u7528\u3057\u3066\u6b21\u306e\u30a2\u30af\u30bb\u30b9\u8a31\u53ef\u304c\u5272\u308a\u5f53\u3066\u3089\u308c\u305f\u30e6\u30fc\u30b6\u30fc\u306b\u306f\u3001\u6b21\u306e\u30a2\u30af\u30bb\u30b9\u8a31\u53ef\u304c\u5272\u308a\u5f53\u3066\u3089\u308c\u307e\u3057\u305f\u3002\n<ul>\n<li>\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u904b\u7528\/\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30c7\u30fc\u30bf\u306e\u57fa\u672c(\u8aad\u307f\u53d6\u308a)\u3001\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u64cd\u4f5c\/\u751f\u30c7\u30fc\u30bf\/\u96fb\u5b50\u30e1\u30fc\u30eb\u3068\u30b3\u30e9\u30dc\u30ec\u30fc\u30b7\u30e7\u30f3\u30e1\u30bf\u30c7\u30fc\u30bf(\u8aad\u307f\u53d6\u308a)\u306a\u3057)\u3002<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p>\u4ee5\u524d\u306f\u3001\u3053\u308c\u3089\u306e\u30ed\u30fc\u30eb\u306f\u3001Microsoft Defender for Office 365\u30a2\u30e9\u30fc\u30c8\u3068\u30a4\u30f3\u30b7\u30c7\u30f3\u30c8\u3001\u304a\u3088\u3073\u9ad8\u5ea6\u306a\u30cf\u30f3\u30c6\u30a3\u30f3\u30b0\u306e\u96fb\u5b50\u30e1\u30fc\u30eb &amp; \u30b3\u30e9\u30dc\u30ec\u30fc\u30b7\u30e7\u30f3 \u30b9\u30ad\u30fc\u30de\u3078\u306e\u30a2\u30af\u30bb\u30b9\u3092\u8a31\u53ef\u3057\u3066\u3044\u307e\u3057\u305f\u3002<\/p>\n<p>  <\/p>\n<p>[\u6e96\u5099\u306b\u5fc5\u8981\u306a\u3053\u3068:]  <\/p>\n<p>\u3053\u306e\u5909\u66f4\u3092\u30ed\u30fc\u30eb\u30a2\u30a6\u30c8\u3057\u305f\u5f8c\u3001\u3053\u308c\u3089\u306e\u30ed\u30fc\u30eb\u306f\u5f15\u304d\u7d9a\u304dMicrosoft Defender for Office 365\u30a2\u30e9\u30fc\u30c8\u3068\u30a4\u30f3\u30b7\u30c7\u30f3\u30c8\u3078\u306e\u30a2\u30af\u30bb\u30b9\u3092\u8a31\u53ef\u3057\u307e\u3059\u304c\u3001\u9ad8\u5ea6\u306a\u30cf\u30f3\u30c6\u30a3\u30f3\u30b0\u306e\u96fb\u5b50\u30e1\u30fc\u30eb &amp; \u30b3\u30e9\u30dc\u30ec\u30fc\u30b7\u30e7\u30f3 \u30b9\u30ad\u30fc\u30de\u306f\u8a31\u53ef\u3057\u307e\u305b\u3093\u3002&nbsp;<\/p>\n<p>\u7d9a\u884c\u3057\u3066\u3001Advanced Hunting \u306e\u96fb\u5b50\u30e1\u30fc\u30eb\u3068\u30b3\u30e9\u30dc\u30ec\u30fc\u30b7\u30e7\u30f3 \u30b9\u30ad\u30fc\u30de\u3078\u306e\u30a2\u30af\u30bb\u30b9\u6a29\u3092\u30c1\u30fc\u30e0\u306b\u4ed8\u4e0e\u3059\u308b\u5834\u5408\u306f\u3001\u8105\u5a01\u30a8\u30af\u30b9\u30d7\u30ed\u30fc\u30e9\u30fc\u3078\u306e\u30a2\u30af\u30bb\u30b9\u306b\u5fc5\u8981\u306a\u306e\u3068\u540c\u3058\u3001\u6b21\u306e\u3044\u305a\u308c\u304b\u306e\u30a2\u30af\u30bb\u30b9\u8a31\u53ef\u3092\u30c1\u30fc\u30e0\u306b\u5272\u308a\u5f53\u3066\u3066\u304f\u3060\u3055\u3044\u3002<\/p>\n<ul>\n<li>Defender XDR Unified RBAC \u304c\u96fb\u5b50\u30e1\u30fc\u30eb\u3068\u30b3\u30e9\u30dc\u30ec\u30fc\u30b7\u30e7\u30f3\u306b\u5bfe\u3057\u3066\u30a2\u30af\u30c6\u30a3\u30d6\u306a\u5834\u5408: \u4ee5\u4e0b\u3092\u5272\u308a\u5f53\u3066\u3066\u304f\u3060\u3055\u3044\u3002<br \/>  \u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u64cd\u4f5c \/ \u751f\u30c7\u30fc\u30bf \/ \u96fb\u5b50\u30e1\u30fc\u30eb\u3068\u30b3\u30e9\u30dc\u30ec\u30fc\u30b7\u30e7\u30f3\u306e\u30e1\u30bf\u30c7\u30fc\u30bf (\u8aad\u307f\u53d6\u308a) \u30a2\u30af\u30bb\u30b9\u8a31\u53ef\u3002<\/li>\n<li>Defender XDR Unified RBAC \u304c\u96fb\u5b50\u30e1\u30fc\u30eb\u3068\u30b3\u30e9\u30dc\u30ec\u30fc\u30b7\u30e7\u30f3\u306b\u5bfe\u3057\u3066\u30a2\u30af\u30c6\u30a3\u30d6\u3067\u306a\u3044\u5834\u5408\u306f\u3001Defender \u30dd\u30fc\u30bf\u30eb\u3067\u6b21\u306e\u96fb\u5b50\u30e1\u30fc\u30eb\u3068\u30b3\u30e9\u30dc\u30ec\u30fc\u30b7\u30e7\u30f3\u306e\u30a2\u30af\u30bb\u30b9\u8a31\u53ef\u3092\u5272\u308a\u5f53\u3066\u3066\u304f\u3060\u3055\u3044\u3002  <br \/>  \u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u95b2\u89a7\u8005\u3001\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3 \u30aa\u30da\u30ec\u30fc\u30bf\u30fc\u3001\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u7ba1\u7406\u8005\u3001Exchange \u7ba1\u7406\u8005\u3001\u30b0\u30ed\u30fc\u30d0\u30eb\u95b2\u89a7\u8005\u3001\u8868\u793a\u306e\u307f\u306e\u53d7\u4fe1\u8005\u3001\u7d44\u7e54\u306e\u7ba1\u7406\u3002<\/li>\n<\/ul>\n<p>\u7b46\u8a18\uff1a<\/p>\n<ul>\n<li>\u3053\u306e\u5909\u66f4\u306f\u3001\u8105\u5a01\u30a8\u30af\u30b9\u30d7\u30ed\u30fc\u30e9\u30fc\u3078\u306e\u30a2\u30af\u30bb\u30b9\u306b\u306f\u5f71\u97ff\u3057\u307e\u305b\u3093<\/li>\n<li>\u30b0\u30ed\u30fc\u30d0\u30eb Entra ID \u30ed\u30fc\u30eb\u306f\u3001\u3053\u306e\u5909\u66f4\u306e\u5f71\u97ff\u3092\u53d7\u3051\u307e\u305b\u3093<\/li>\n<\/ul>\n<p>\u8a73\u7d30\u306b\u3064\u3044\u3066\u306f\u3001\u6b21\u306e\u30ea\u30bd\u30fc\u30b9\u3092\u78ba\u8a8d\u3057\u3066\u304f\u3060\u3055\u3044\u3002<\/p>\n<ul>\n<li>\u9ad8\u5ea6\u306a\u30cf\u30f3\u30c6\u30a3\u30f3\u30b0\u306e\u30a2\u30af\u30bb\u30b9\u8a31\u53ef\u306e\u8a73\u7d30\u306b\u3064\u3044\u3066\u306f\u3001\u300c <a href=\"https:\/\/learn.microsoft.com\/microsoft-365\/security\/defender\/custom-roles?view=o365-worldwide\" target=\"_blank\" rel=\"noopener\">  \u30ed\u30fc\u30eb\u30d9\u30fc\u30b9\u306e\u30a2\u30af\u30bb\u30b9\u5236\u5fa1\u306e\u30ab\u30b9\u30bf\u30e0 \u30ed\u30fc\u30eb |Microsoft Learn (\u82f1\u8a9e)<\/a><\/li>\n<li>\u8105\u5a01\u30a8\u30af\u30b9\u30d7\u30ed\u30fc\u30e9\u30fc\u306e\u30a2\u30af\u30bb\u30b9\u8a31\u53ef\u306e\u8a73\u7d30\u306b\u3064\u3044\u3066\u306f\u3001\u300c <a href=\"https:\/\/learn.microsoft.com\/microsoft-365\/security\/office-365-security\/threat-explorer-real-time-detections-about?view=o365-worldwide#permissions-and-licensing-for-threat-explorer-and-real-time-detections\" target=\"_blank\" rel=\"noopener\">  \u8105\u5a01\u30a8\u30af\u30b9\u30d7\u30ed\u30fc\u30e9\u30fc\u306b\u3064\u3044\u3066\u300d\u304a\u3088\u3073\u300cMicrosoft Defender for Office 365\u3067\u306e\u30ea\u30a2\u30eb\u30bf\u30a4\u30e0\u691c\u51fa\u300d\u3092\u53c2\u7167\u3057\u3066\u304f\u3060\u3055\u3044\u3002Microsoft Learn (\u82f1\u8a9e)<\/a>  <\/li>\n<\/ul>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>MC787370 | Advanced Hunting Permissions update for some Microsoft Defender for Office 365 security admins Clas [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-6219","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"_links":{"self":[{"href":"https:\/\/m365jp.net\/index.php\/wp-json\/wp\/v2\/posts\/6219","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/m365jp.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/m365jp.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/m365jp.net\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/m365jp.net\/index.php\/wp-json\/wp\/v2\/comments?post=6219"}],"version-history":[{"count":0,"href":"https:\/\/m365jp.net\/index.php\/wp-json\/wp\/v2\/posts\/6219\/revisions"}],"wp:attachment":[{"href":"https:\/\/m365jp.net\/index.php\/wp-json\/wp\/v2\/media?parent=6219"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/m365jp.net\/index.php\/wp-json\/wp\/v2\/categories?post=6219"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/m365jp.net\/index.php\/wp-json\/wp\/v2\/tags?post=6219"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}